I'd take the perspective that most large company exploits occur because of under-visibility of risk, which ultimately leads to under-funding. It's easy to say

I'd take the perspective that most large company exploits occur because of under-visibility of risk, which ultimately leads to under-funding. It's easy to say "Our systems are secure and follow all standards" when they aren't and they don't. It's harder to explain why projects keep coming up with multiple successful pentests or security flags. Increasing visibility of risk and aligning incentives, with a credible and independent validation party, is the solution. The biggest gotcha: payment must be for a successful penetration, and must not be for some paperwork flagging of minutiae.